gnsrecord_crypto.c File Reference

API for GNS record-related crypto. More...

#include "gnsrecord_crypto.h"

Include dependency graph for gnsrecord_crypto.c:

Go to the source code of this file.

Data Structures
struct	KeyCacheLine
	Line in cache mapping private keys to public keys. More...

Macros
#define	LOG(kind, ...)   GNUNET_log_from (kind, "gnsrecord", __VA_ARGS__)
#define	CSIZE   64

Functions
ssize_t	ecdsa_symmetric_decrypt (const void *block, size_t size, const unsigned char *key, const unsigned char *ctr, void *result)
ssize_t	ecdsa_symmetric_encrypt (const void *block, size_t size, const unsigned char *key, const unsigned char *ctr, void *result)
enum GNUNET_GenericReturnValue	eddsa_symmetric_decrypt (const void *block, size_t size, const unsigned char *key, const unsigned char *nonce, void *result)
enum GNUNET_GenericReturnValue	eddsa_symmetric_encrypt (const void *block, size_t size, const unsigned char *key, const unsigned char *nonce, void *result)
void	GNR_derive_block_aes_key (unsigned char *ctr, unsigned char *key, const char *label, uint64_t exp, const struct GNUNET_CRYPTO_EcdsaPublicKey *pub)
	Derive session key and iv from label and public key. More...
void	GNR_derive_block_xsalsa_key (unsigned char *nonce, unsigned char *key, const char *label, uint64_t exp, const struct GNUNET_CRYPTO_EddsaPublicKey *pub)
	Derive session key and iv from label and public key. More...
static ssize_t	block_get_size_ecdsa (const struct GNUNET_GNSRECORD_Data *rd, unsigned int rd_count)
static enum GNUNET_GenericReturnValue	block_create_ecdsa (const struct GNUNET_CRYPTO_EcdsaPrivateKey *key, const struct GNUNET_CRYPTO_EcdsaPublicKey *pkey, struct GNUNET_TIME_Absolute expire, const char *label, const struct GNUNET_GNSRECORD_Data *rd, unsigned int rd_count, struct GNUNET_GNSRECORD_Block **block)
	Sign name and records. More...
static ssize_t	block_get_size_eddsa (const struct GNUNET_GNSRECORD_Data *rd, unsigned int rd_count)
enum GNUNET_GenericReturnValue	block_create_eddsa (const struct GNUNET_CRYPTO_EddsaPrivateKey *key, const struct GNUNET_CRYPTO_EddsaPublicKey *pkey, struct GNUNET_TIME_Absolute expire, const char *label, const struct GNUNET_GNSRECORD_Data *rd, unsigned int rd_count, struct GNUNET_GNSRECORD_Block **block)
	Sign name and records (EDDSA version) More...
ssize_t	GNUNET_GNSRECORD_block_calculate_size (const struct GNUNET_IDENTITY_PrivateKey *key, const struct GNUNET_GNSRECORD_Data *rd, unsigned int rd_count)
	Get size of buffer for block creation. More...
enum GNUNET_GenericReturnValue	GNUNET_GNSRECORD_block_create (const struct GNUNET_IDENTITY_PrivateKey *key, struct GNUNET_TIME_Absolute expire, const char *label, const struct GNUNET_GNSRECORD_Data *rd, unsigned int rd_count, struct GNUNET_GNSRECORD_Block **result)
	Sign name and records. More...
enum GNUNET_GenericReturnValue	GNUNET_GNSRECORD_block_create2 (const struct GNUNET_IDENTITY_PrivateKey *pkey, struct GNUNET_TIME_Absolute expire, const char *label, const struct GNUNET_GNSRECORD_Data *rd, unsigned int rd_count, struct GNUNET_GNSRECORD_Block **result)
	Sign name and records, cache derived public key (also keeps the private key in static memory, so do not use this function if keeping the private key in the process'es RAM is a major issue). More...
enum GNUNET_GenericReturnValue	GNUNET_GNSRECORD_block_verify (const struct GNUNET_GNSRECORD_Block *block)
	Check if a signature is valid. More...
enum GNUNET_GenericReturnValue	block_decrypt_ecdsa (const struct GNUNET_GNSRECORD_Block *block, const struct GNUNET_CRYPTO_EcdsaPublicKey *zone_key, const char *label, GNUNET_GNSRECORD_RecordCallback proc, void *proc_cls)
enum GNUNET_GenericReturnValue	block_decrypt_eddsa (const struct GNUNET_GNSRECORD_Block *block, const struct GNUNET_CRYPTO_EddsaPublicKey *zone_key, const char *label, GNUNET_GNSRECORD_RecordCallback proc, void *proc_cls)
enum GNUNET_GenericReturnValue	GNUNET_GNSRECORD_block_decrypt (const struct GNUNET_GNSRECORD_Block *block, const struct GNUNET_IDENTITY_PublicKey *zone_key, const char *label, GNUNET_GNSRECORD_RecordCallback proc, void *proc_cls)
	Decrypt block. More...
void	GNUNET_GNSRECORD_query_from_private_key (const struct GNUNET_IDENTITY_PrivateKey *zone, const char *label, struct GNUNET_HashCode *query)
	Calculate the DHT query for a given label in a given zone. More...
void	GNUNET_GNSRECORD_query_from_public_key (const struct GNUNET_IDENTITY_PublicKey *pub, const char *label, struct GNUNET_HashCode *query)
	Calculate the DHT query for a given label in a given zone. More...

Detailed Description

API for GNS record-related crypto.

Author

Martin Schanzenbach

Matthias Wachs

Christian Grothoff

Definition in file gnsrecord_crypto.c.

Macro Definition Documentation

LOG

#define LOG	(		kind,
			...
	)		GNUNET_log_from (kind, "gnsrecord", __VA_ARGS__)

Definition at line 30 of file gnsrecord_crypto.c.

CSIZE

#define CSIZE   64

Function Documentation

ecdsa_symmetric_decrypt()

ssize_t ecdsa_symmetric_decrypt	(	const void *	block,
		size_t	size,
		const unsigned char *	key,
		const unsigned char *	ctr,
		void *	result
	)

Definition at line 33 of file gnsrecord_crypto.c.

{
  gcry_cipher_hd_t handle;
  int rc;
 
  GNUNET_assert (0 == gcry_cipher_open (&handle, GCRY_CIPHER_AES256,
                                        GCRY_CIPHER_MODE_CTR, 0));
  rc = gcry_cipher_setkey (handle,
                           key,
                           GNUNET_CRYPTO_AES_KEY_LENGTH);
  GNUNET_assert ((0 == rc) || ((char) rc == GPG_ERR_WEAK_KEY));
  rc = gcry_cipher_setctr (handle,
                           ctr,
                           GNUNET_CRYPTO_AES_KEY_LENGTH / 2);
  GNUNET_assert ((0 == rc) || ((char) rc == GPG_ERR_WEAK_KEY));
  GNUNET_assert (0 == gcry_cipher_decrypt (handle, result, size, block, size));
  gcry_cipher_close (handle);
  return size;
}

References GNUNET_assert, GNUNET_CRYPTO_AES_KEY_LENGTH, handle, key, result, and size.

ecdsa_symmetric_encrypt()

ssize_t ecdsa_symmetric_encrypt	(	const void *	block,
		size_t	size,
		const unsigned char *	key,
		const unsigned char *	ctr,
		void *	result
	)

Definition at line 60 of file gnsrecord_crypto.c.

{
  gcry_cipher_hd_t handle;
  int rc;
 
  GNUNET_assert (0 == gcry_cipher_open (&handle, GCRY_CIPHER_AES256,
                                        GCRY_CIPHER_MODE_CTR, 0));
  rc = gcry_cipher_setkey (handle,
                           key,
                           GNUNET_CRYPTO_AES_KEY_LENGTH);
  GNUNET_assert ((0 == rc) || ((char) rc == GPG_ERR_WEAK_KEY));
  rc = gcry_cipher_setctr (handle,
                           ctr,
                           GNUNET_CRYPTO_AES_KEY_LENGTH / 2);
  GNUNET_assert ((0 == rc) || ((char) rc == GPG_ERR_WEAK_KEY));
  GNUNET_assert (0 == gcry_cipher_encrypt (handle, result, size, block, size));
  gcry_cipher_close (handle);
  return size;
}

References GNUNET_assert, GNUNET_CRYPTO_AES_KEY_LENGTH, handle, key, result, and size.

eddsa_symmetric_decrypt()

enum GNUNET_GenericReturnValue eddsa_symmetric_decrypt	(	const void *	block,
		size_t	size,
		const unsigned char *	key,
		const unsigned char *	nonce,
		void *	result
	)

Definition at line 60 of file gnsrecord_crypto.c.

{
  ssize_t ctlen = size - crypto_secretbox_MACBYTES;
  if (ctlen < 0)
    return GNUNET_SYSERR;
  if (0 != crypto_secretbox_open_detached (result,
                                           ((unsigned char*) block) + crypto_secretbox_MACBYTES, // Ciphertext
                                           block, // Tag
                                           ctlen,
                                           nonce, key))
  {
    return GNUNET_SYSERR;
  }
  return GNUNET_OK;
}

eddsa_symmetric_encrypt()

enum GNUNET_GenericReturnValue eddsa_symmetric_encrypt	(	const void *	block,
		size_t	size,
		const unsigned char *	key,
		const unsigned char *	nonce,
		void *	result
	)

Definition at line 60 of file gnsrecord_crypto.c.

{
  if (size > crypto_secretbox_MESSAGEBYTES_MAX)
    return GNUNET_SYSERR;
  crypto_secretbox_detached (result + crypto_secretbox_MACBYTES, // Ciphertext
                             result, // TAG
                             block, size, nonce, key);
  return GNUNET_OK;
}

GNR_derive_block_aes_key()

void GNR_derive_block_aes_key	(	unsigned char *	ctr,
		unsigned char *	key,
		const char *	label,
		uint64_t	exp,
		const struct GNUNET_CRYPTO_EcdsaPublicKey *	pub
	)

Derive session key and iv from label and public key.

Parameters

iv	initialization vector to initialize
skey	session key to initialize
label	label to use for KDF
pub	public key to use for KDF

4 byte nonce

Expiration time 64 bit.

Set counter part to 1

Definition at line 127 of file gnsrecord_crypto.c.

{
  static const char ctx_key[] = "gns-aes-ctx-key";
  static const char ctx_iv[] = "gns-aes-ctx-iv";
 
  GNUNET_CRYPTO_kdf (key, GNUNET_CRYPTO_AES_KEY_LENGTH,
                     ctx_key, strlen (ctx_key),
                     pub, sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey),
                     label, strlen (label),
                     NULL, 0);
  memset (ctr, 0, GNUNET_CRYPTO_AES_KEY_LENGTH / 2);
  GNUNET_CRYPTO_kdf (ctr, 4,
                     ctx_iv, strlen (ctx_iv),
                     pub, sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey),
                     label, strlen (label),
                     NULL, 0);
  memcpy (ctr + 4, &exp, sizeof (exp));
  ctr[15] |= 0x01;
}

References GNUNET_CRYPTO_AES_KEY_LENGTH, GNUNET_CRYPTO_kdf(), key, and pub.

Referenced by run_pkey().

Here is the call graph for this function:

Here is the caller graph for this function:

GNR_derive_block_xsalsa_key()

void GNR_derive_block_xsalsa_key	(	unsigned char *	nonce,
		unsigned char *	key,
		const char *	label,
		uint64_t	exp,
		const struct GNUNET_CRYPTO_EddsaPublicKey *	pub
	)

Derive session key and iv from label and public key.

Parameters

nonce	initialization vector to initialize
skey	session key to initialize
label	label to use for KDF
pub	public key to use for KDF

16 byte nonce

Expiration time 64 bit.

Definition at line 156 of file gnsrecord_crypto.c.

{
  static const char ctx_key[] = "gns-xsalsa-ctx-key";
  static const char ctx_iv[] = "gns-xsalsa-ctx-iv";
 
  GNUNET_CRYPTO_kdf (key, crypto_secretbox_KEYBYTES,
                     ctx_key, strlen (ctx_key),
                     pub, sizeof(struct GNUNET_CRYPTO_EddsaPublicKey),
                     label, strlen (label),
                     NULL, 0);
  memset (nonce, 0, crypto_secretbox_NONCEBYTES);
  GNUNET_CRYPTO_kdf (nonce, (crypto_secretbox_NONCEBYTES - sizeof (exp)),
                     ctx_iv, strlen (ctx_iv),
                     pub, sizeof(struct GNUNET_CRYPTO_EddsaPublicKey),
                     label, strlen (label),
                     NULL, 0);
  memcpy (nonce + (crypto_secretbox_NONCEBYTES - sizeof (exp)),
          &exp, sizeof (exp));
}

References GNUNET_CRYPTO_kdf(), key, and pub.

Referenced by run_edkey().

Here is the call graph for this function:

Here is the caller graph for this function:

block_get_size_ecdsa()

static ssize_t block_get_size_ecdsa ( const struct GNUNET_GNSRECORD_Data *  rd, unsigned int  rd_count  )

static

Definition at line 184 of file gnsrecord_crypto.c.

{
  ssize_t len;
 
  len = GNUNET_GNSRECORD_records_get_size (rd_count, rd);
  if (len < 0)
    return -1;
  len += sizeof(struct GNUNET_GNSRECORD_Block);
  return len;
}

Referenced by block_decrypt_ecdsa().

Here is the caller graph for this function:

block_create_ecdsa()

static enum GNUNET_GenericReturnValue block_create_ecdsa ( const struct GNUNET_CRYPTO_EcdsaPrivateKey *  key, const struct GNUNET_CRYPTO_EcdsaPublicKey *  pkey, struct GNUNET_TIME_Absolute  expire, const char *  label, const struct GNUNET_GNSRECORD_Data *  rd, unsigned int  rd_count, struct GNUNET_GNSRECORD_Block **  block  )

static

Sign name and records.

Parameters

key	the private key
pkey	associated public key
expire	block expiration
label	the name for the records
rd	record data
rd_count	number of records
block	the block result. Must be allocated sufficiently.

Returns

GNUNET_SYSERR on error (otherwise GNUNET_OK)

Definition at line 184 of file gnsrecord_crypto.c.

{
  ssize_t payload_len = GNUNET_GNSRECORD_records_get_size (rd_count,
                                                           rd);
  struct GNUNET_GNSRECORD_EcdsaBlock *ecblock;
  struct GNRBlockPS *gnr_block;
  unsigned char ctr[GNUNET_CRYPTO_AES_KEY_LENGTH / 2];
  unsigned char skey[GNUNET_CRYPTO_AES_KEY_LENGTH];
  struct GNUNET_GNSRECORD_Data rdc[GNUNET_NZL (rd_count)];
  struct GNUNET_TIME_Absolute now;
 
  if (payload_len < 0)
  {
    GNUNET_break (0);
    return GNUNET_SYSERR;
  }
  if (payload_len > GNUNET_GNSRECORD_MAX_BLOCK_SIZE)
  {
    GNUNET_break (0);
    return GNUNET_SYSERR;
  }
  /* convert relative to absolute times */
  now = GNUNET_TIME_absolute_get ();
  for (unsigned int i = 0; i < rd_count; i++)
  {
    rdc[i] = rd[i];
    if (0 != (rd[i].flags & GNUNET_GNSRECORD_RF_RELATIVE_EXPIRATION))
    {
      struct GNUNET_TIME_Relative t;
 
      /* encrypted blocks must never have relative expiration times, convert! */
      rdc[i].flags &= ~GNUNET_GNSRECORD_RF_RELATIVE_EXPIRATION;
      t.rel_value_us = rdc[i].expiration_time;
      rdc[i].expiration_time = GNUNET_TIME_absolute_add (now, t).abs_value_us;
    }
  }
  /* serialize */
  *block = GNUNET_malloc (sizeof (struct GNUNET_GNSRECORD_Block) + payload_len);
  (*block)->size = htonl(sizeof (struct GNUNET_GNSRECORD_Block) + payload_len);
  {
    char payload[payload_len];
 
    GNUNET_assert (payload_len ==
                   GNUNET_GNSRECORD_records_serialize (rd_count,
                                                       rdc,
                                                       payload_len,
                                                       payload));
    gnr_block = GNUNET_malloc (sizeof (struct GNRBlockPS) + payload_len);
    ecblock = &(*block)->ecdsa_block;
    (*block)->type = htonl (GNUNET_GNSRECORD_TYPE_PKEY);
    gnr_block->purpose.size = htonl (sizeof(struct GNRBlockPS) + payload_len);
    gnr_block->purpose.purpose =
      htonl (GNUNET_SIGNATURE_PURPOSE_GNS_RECORD_SIGN);
    gnr_block->expiration_time = GNUNET_TIME_absolute_hton (expire);
    ecblock->expiration_time = gnr_block->expiration_time;
    /* encrypt and sign */
    GNUNET_CRYPTO_ecdsa_public_key_derive (pkey,
                                           label,
                                           "gns",
                                           &ecblock->derived_key);
    GNR_derive_block_aes_key (ctr,
                              skey,
                              label,
                              ecblock->expiration_time.abs_value_us__,
                              pkey);
    GNUNET_assert (payload_len ==
                   ecdsa_symmetric_encrypt (payload,
                                            payload_len,
                                            skey,
                                            ctr,
                                            &ecblock[1]));
    GNUNET_memcpy (&gnr_block[1], &ecblock[1], payload_len);
  }
  if (GNUNET_OK !=
      GNUNET_CRYPTO_ecdsa_sign_derived (key,
                                        label,
                                        "gns",
                                        &gnr_block->purpose,
                                        &ecblock->signature))
  {
    GNUNET_break (0);
    GNUNET_free (*block);
    GNUNET_free (gnr_block);
    return GNUNET_SYSERR;
  }
  GNUNET_free (gnr_block);
  return GNUNET_OK;
}

References GNUNET_GNSRECORD_records_get_size(), and len.

Here is the call graph for this function:

block_get_size_eddsa()

static ssize_t block_get_size_eddsa ( const struct GNUNET_GNSRECORD_Data *  rd, unsigned int  rd_count  )

static

Definition at line 306 of file gnsrecord_crypto.c.

{
  ssize_t len;
 
  len = GNUNET_GNSRECORD_records_get_size (rd_count, rd);
  if (len < 0)
    return -1;
  len += sizeof(struct GNUNET_GNSRECORD_Block);
  len += crypto_secretbox_MACBYTES;
  return len;
}

Referenced by block_decrypt_ecdsa().

Here is the caller graph for this function:

block_create_eddsa()

enum GNUNET_GenericReturnValue block_create_eddsa	(	const struct GNUNET_CRYPTO_EddsaPrivateKey *	key,
		const struct GNUNET_CRYPTO_EddsaPublicKey *	pkey,
		struct GNUNET_TIME_Absolute	expire,
		const char *	label,
		const struct GNUNET_GNSRECORD_Data *	rd,
		unsigned int	rd_count,
		struct GNUNET_GNSRECORD_Block **	block
	)

Sign name and records (EDDSA version)

Parameters

key	the private key
pkey	associated public key
expire	block expiration
label	the name for the records
rd	record data
rd_count	number of records
block	where to store the block. Must be allocated sufficiently.

Returns

GNUNET_SYSERR on error (otherwise GNUNET_OK)

Definition at line 306 of file gnsrecord_crypto.c.

{
  ssize_t payload_len = GNUNET_GNSRECORD_records_get_size (rd_count,
                                                           rd);
  struct GNUNET_GNSRECORD_EddsaBlock *edblock;
  struct GNRBlockPS *gnr_block;
  unsigned char nonce[crypto_secretbox_NONCEBYTES];
  unsigned char skey[crypto_secretbox_KEYBYTES];
  struct GNUNET_GNSRECORD_Data rdc[GNUNET_NZL (rd_count)];
  struct GNUNET_TIME_Absolute now;
 
  if (payload_len < 0)
  {
    GNUNET_break (0);
    return GNUNET_SYSERR;
  }
  if (payload_len > GNUNET_GNSRECORD_MAX_BLOCK_SIZE)
  {
    GNUNET_break (0);
    return GNUNET_SYSERR;
  }
  /* convert relative to absolute times */
  now = GNUNET_TIME_absolute_get ();
  for (unsigned int i = 0; i < rd_count; i++)
  {
    rdc[i] = rd[i];
    if (0 != (rd[i].flags & GNUNET_GNSRECORD_RF_RELATIVE_EXPIRATION))
    {
      struct GNUNET_TIME_Relative t;
 
      /* encrypted blocks must never have relative expiration times, convert! */
      rdc[i].flags &= ~GNUNET_GNSRECORD_RF_RELATIVE_EXPIRATION;
      t.rel_value_us = rdc[i].expiration_time;
      rdc[i].expiration_time = GNUNET_TIME_absolute_add (now, t).abs_value_us;
    }
  }
  /* serialize */
  *block = GNUNET_malloc (sizeof (struct GNUNET_GNSRECORD_Block)
                          + payload_len + crypto_secretbox_MACBYTES);
  (*block)->size = htonl(sizeof (struct GNUNET_GNSRECORD_Block)
                 + payload_len + crypto_secretbox_MACBYTES);
  {
    char payload[payload_len];
 
    GNUNET_assert (payload_len ==
                   GNUNET_GNSRECORD_records_serialize (rd_count,
                                                       rdc,
                                                       payload_len,
                                                       payload));
    gnr_block = GNUNET_malloc (sizeof (struct GNRBlockPS)
                               + payload_len
                               + crypto_secretbox_MACBYTES);
    edblock = &(*block)->eddsa_block;
    (*block)->type = htonl (GNUNET_GNSRECORD_TYPE_EDKEY);
    gnr_block->purpose.size =
      htonl (sizeof(struct GNRBlockPS)
             + payload_len
             + crypto_secretbox_MACBYTES);
    gnr_block->purpose.purpose =
      htonl (GNUNET_SIGNATURE_PURPOSE_GNS_RECORD_SIGN);
    gnr_block->expiration_time = GNUNET_TIME_absolute_hton (expire);
    edblock->expiration_time = gnr_block->expiration_time;
    /* encrypt and sign */
    GNUNET_CRYPTO_eddsa_public_key_derive (pkey,
                                           label,
                                           "gns",
                                           &edblock->derived_key);
    GNR_derive_block_xsalsa_key (nonce,
                                 skey,
                                 label,
                                 edblock->expiration_time.abs_value_us__,
                                 pkey);
    GNUNET_assert (GNUNET_OK ==
                   eddsa_symmetric_encrypt (payload,
                                            payload_len,
                                            skey,
                                            nonce,
                                            &edblock[1]));
    GNUNET_memcpy (&gnr_block[1], &edblock[1],
                   payload_len + crypto_secretbox_MACBYTES);
 
    GNUNET_CRYPTO_eddsa_sign_derived (key,
                                      label,
                                      "gns",
                                      &gnr_block->purpose,
                                      &edblock->signature);
  }
  return GNUNET_OK;
}

References GNUNET_GNSRECORD_records_get_size(), and len.

Here is the call graph for this function:

block_decrypt_ecdsa()

enum GNUNET_GenericReturnValue block_decrypt_ecdsa	(	const struct GNUNET_GNSRECORD_Block *	block,
		const struct GNUNET_CRYPTO_EcdsaPublicKey *	zone_key,
		const char *	label,
		GNUNET_GNSRECORD_RecordCallback	proc,
		void *	proc_cls
	)

Definition at line 430 of file gnsrecord_crypto.c.

{
  size_t payload_len = ntohl (block->size) - sizeof (struct
                                                     GNUNET_GNSRECORD_Block);
  unsigned char ctr[GNUNET_CRYPTO_AES_KEY_LENGTH / 2];
  unsigned char key[GNUNET_CRYPTO_AES_KEY_LENGTH];
 
  if (ntohl (block->size) <
      sizeof(struct GNUNET_CRYPTO_EccSignaturePurpose)
      + sizeof(struct GNUNET_TIME_AbsoluteNBO))
  {
    GNUNET_break_op (0);
    return GNUNET_SYSERR;
  }
  GNR_derive_block_aes_key (ctr,
                            key,
                            label,
                            block->ecdsa_block.expiration_time.abs_value_us__,
                            zone_key);
  {
    char payload[payload_len];
    unsigned int rd_count;
 
    GNUNET_assert (payload_len ==
                   ecdsa_symmetric_decrypt (&block[1], payload_len,
                                            key, ctr,
                                            payload));
    rd_count = GNUNET_GNSRECORD_records_deserialize_get_size (payload_len,
                                                              payload);
    if (rd_count > 2048)
    {
      /* limit to sane value */
      GNUNET_break_op (0);
      return GNUNET_SYSERR;
    }
    {
      struct GNUNET_GNSRECORD_Data rd[GNUNET_NZL (rd_count)];
      unsigned int j;
      struct GNUNET_TIME_Absolute now;
 
      if (GNUNET_OK !=
          GNUNET_GNSRECORD_records_deserialize (payload_len,
                                                payload,
                                                rd_count,
                                                rd))
      {
        GNUNET_break_op (0);
        return GNUNET_SYSERR;
      }
      /* hide expired records */
      now = GNUNET_TIME_absolute_get ();
      j = 0;
      for (unsigned int i = 0; i < rd_count; i++)
      {
        if (0 != (rd[i].flags & GNUNET_GNSRECORD_RF_RELATIVE_EXPIRATION))
        {
          /* encrypted blocks must never have relative expiration times, skip! */
          GNUNET_break_op (0);
          continue;
        }
 
        if (0 != (rd[i].flags & GNUNET_GNSRECORD_RF_SHADOW_RECORD))
        {
          int include_record = GNUNET_YES;
          /* Shadow record, figure out if we have a not expired active record */
          for (unsigned int k = 0; k < rd_count; k++)
          {
            if (k == i)
              continue;
            if (rd[i].expiration_time < now.abs_value_us)
              include_record = GNUNET_NO;       /* Shadow record is expired */
            if ((rd[k].record_type == rd[i].record_type) &&
                (rd[k].expiration_time >= now.abs_value_us) &&
                (0 == (rd[k].flags & GNUNET_GNSRECORD_RF_SHADOW_RECORD)))
            {
              include_record = GNUNET_NO;         /* We have a non-expired, non-shadow record of the same type */
              GNUNET_log (GNUNET_ERROR_TYPE_INFO,
                          "Ignoring shadow record\n");
              break;
            }
          }
          if (GNUNET_YES == include_record)
          {
            rd[i].flags ^= GNUNET_GNSRECORD_RF_SHADOW_RECORD;       /* Remove Flag */
            if (j != i)
              rd[j] = rd[i];
            j++;
          }
        }
        else if (rd[i].expiration_time >= now.abs_value_us)
        {
          /* Include this record */
          if (j != i)
            rd[j] = rd[i];
          j++;
        }
        else
        {
          struct GNUNET_TIME_Absolute at;
 
          at.abs_value_us = rd[i].expiration_time;
          GNUNET_log (GNUNET_ERROR_TYPE_INFO,
                      "Excluding record that expired %s (%llu ago)\n",
                      GNUNET_STRINGS_absolute_time_to_string (at),
                      (unsigned long long) rd[i].expiration_time
                      - now.abs_value_us);
        }
      }
      rd_count = j;
      if (NULL != proc)
        proc (proc_cls,
              rd_count,
              (0 != rd_count) ? rd : NULL);
    }
  }
  return GNUNET_OK;
}

References block_get_size_ecdsa(), block_get_size_eddsa(), GNUNET_assert, GNUNET_GNSRECORD_TYPE_EDKEY, GNUNET_GNSRECORD_TYPE_PKEY, GNUNET_IDENTITY_key_get_public(), key, pkey, and res.

Here is the call graph for this function:

block_decrypt_eddsa()

enum GNUNET_GenericReturnValue block_decrypt_eddsa	(	const struct GNUNET_GNSRECORD_Block *	block,
		const struct GNUNET_CRYPTO_EddsaPublicKey *	zone_key,
		const char *	label,
		GNUNET_GNSRECORD_RecordCallback	proc,
		void *	proc_cls
	)

Definition at line 430 of file gnsrecord_crypto.c.

{
  size_t payload_len = ntohl (block->size) - sizeof (struct
                                                     GNUNET_GNSRECORD_Block);
  unsigned char nonce[crypto_secretbox_NONCEBYTES];
  unsigned char key[crypto_secretbox_KEYBYTES];
 
  if (ntohl (block->size) <
      sizeof(struct GNUNET_CRYPTO_EccSignaturePurpose)
      + sizeof(struct GNUNET_TIME_AbsoluteNBO))
  {
    GNUNET_break_op (0);
    return GNUNET_SYSERR;
  }
  GNR_derive_block_xsalsa_key (nonce,
                               key,
                               label,
                               block->eddsa_block.expiration_time.abs_value_us__,
                               zone_key);
  {
    char payload[payload_len];
    unsigned int rd_count;
 
    GNUNET_assert (GNUNET_OK ==
                   eddsa_symmetric_decrypt (&block[1], payload_len,
                                            key, nonce,
                                            payload));
    payload_len -= crypto_secretbox_MACBYTES;
    rd_count = GNUNET_GNSRECORD_records_deserialize_get_size (payload_len,
                                                              payload);
    if (rd_count > 2048)
    {
      /* limit to sane value */
      GNUNET_break_op (0);
      return GNUNET_SYSERR;
    }
    {
      struct GNUNET_GNSRECORD_Data rd[GNUNET_NZL (rd_count)];
      unsigned int j;
      struct GNUNET_TIME_Absolute now;
 
      if (GNUNET_OK !=
          GNUNET_GNSRECORD_records_deserialize (payload_len,
                                                payload,
                                                rd_count,
                                                rd))
      {
        GNUNET_break_op (0);
        return GNUNET_SYSERR;
      }
      /* hide expired records */
      now = GNUNET_TIME_absolute_get ();
      j = 0;
      for (unsigned int i = 0; i < rd_count; i++)
      {
        if (0 != (rd[i].flags & GNUNET_GNSRECORD_RF_RELATIVE_EXPIRATION))
        {
          /* encrypted blocks must never have relative expiration times, skip! */
          GNUNET_break_op (0);
          continue;
        }
 
        if (0 != (rd[i].flags & GNUNET_GNSRECORD_RF_SHADOW_RECORD))
        {
          int include_record = GNUNET_YES;
          /* Shadow record, figure out if we have a not expired active record */
          for (unsigned int k = 0; k < rd_count; k++)
          {
            if (k == i)
              continue;
            if (rd[i].expiration_time < now.abs_value_us)
              include_record = GNUNET_NO;       /* Shadow record is expired */
            if ((rd[k].record_type == rd[i].record_type) &&
                (rd[k].expiration_time >= now.abs_value_us) &&
                (0 == (rd[k].flags & GNUNET_GNSRECORD_RF_SHADOW_RECORD)))
            {
              include_record = GNUNET_NO;         /* We have a non-expired, non-shadow record of the same type */
              GNUNET_log (GNUNET_ERROR_TYPE_INFO,
                          "Ignoring shadow record\n");
              break;
            }
          }
          if (GNUNET_YES == include_record)
          {
            rd[i].flags ^= GNUNET_GNSRECORD_RF_SHADOW_RECORD;       /* Remove Flag */
            if (j != i)
              rd[j] = rd[i];
            j++;
          }
        }
        else if (rd[i].expiration_time >= now.abs_value_us)
        {
          /* Include this record */
          if (j != i)
            rd[j] = rd[i];
          j++;
        }
        else
        {
          struct GNUNET_TIME_Absolute at;
 
          at.abs_value_us = rd[i].expiration_time;
          GNUNET_log (GNUNET_ERROR_TYPE_INFO,
                      "Excluding record that expired %s (%llu ago)\n",
                      GNUNET_STRINGS_absolute_time_to_string (at),
                      (unsigned long long) rd[i].expiration_time
                      - now.abs_value_us);
        }
      }
      rd_count = j;
      if (NULL != proc)
        proc (proc_cls,
              rd_count,
              (0 != rd_count) ? rd : NULL);
    }
  }
  return GNUNET_OK;
}